Detections
Analytics
Nagios XI < 2009R1.3 Multiple Vulnerabilities
low Nessus Network Monitor Plugin ID 8370
Synopsis
A vulnerable version of Nagios XI has been detected.Description
Versions of Nagios XI prior to 2009R1.3 are affected by multiple vulnerabilities:- Nagios XI is affected by multiple cross-site scripting vulnerabilities due to its failure to properly sanitize user-supplied input to the 'login.php' script. A remote attacker could exploit these vulnerabilities by tricking a user into requesting a maliciously crafted URL, causing script code to be run in the user's browser in the context of the affected site.
- Nagios XI is affected by an SQL injection vulnerability due to its failure to properly sanitize user-supplied data to the 'record' parameter of the 'admin/users.php' script before using it in an SQL query. Successful exploitation of this vulnerability would allow the attacker to access and modify data and compromise the application. Note that the attacker must be authenticated to exploit this vulnerability.
Solution
Upgrade to Nagios XI 2009R1.3 or later.See Also
http://assets.nagios.com/downloads/nagiosxi/CHANGES-2009.TXT